Issues

BountiesService.expireOverdue() overwrites concurrently-advanced bounties to EXPIRED — read-then-save with no status re-check and no assertTransition
MergeFi/backend#460 · opened on Sep 27, 2026
3
assignReward decrements MaintenancePool.balance before poolWithdraw() and never restores it when the withdrawal fails
MergeFi/backend#459 · opened on Sep 27, 2026
5
[Regression on closed #273] assignReward's double-payout guard is keyed on (pool, recipient) instead of (pool, issue) — the same issue can still be paid twice
MergeFi/backend#458 · opened on Sep 27, 2026
4
MaintenancePoolService.deposit() always throws PessimisticLockTransactionRequiredError — the #275 SELECT ... FOR UPDATE runs outside any transaction
MergeFi/backend#457 · opened on Sep 27, 2026
5
GithubWebhooksController.handle always returns 202 even when handleEvent marks the event FAILED, and no job ever reprocesses FAILED WebhookEvent rows
MergeFi/backend#317 · opened on Sep 17, 2026
4
releasePartial() sends the wrong on-chain key to the contract — a raw UUID instead of the numeric onChainId every other operation uses
MergeFi/backend#300 · opened on Sep 17, 2026
5
EscrowService.refund()/release() check the caller's role but never bind the check to the specific escrow's sponsor — any SPONSOR can force-refund any other sponsor's escrow
MergeFi/backend#299 · opened on Sep 17, 2026
2
Bounty/Milestone/MaintenancePool/User list endpoints have no pagination and return the entire table in one unbounded response
MergeFi/backend#63 · opened on Aug 16, 2026
3
TeamMemberSplit.user uses onDelete: CASCADE, so deleting any team member's account silently desyncs a team's split percentages from 100 and can permanently strand that team's bounty
MergeFi/backend#58 · opened on Aug 16, 2026
2
Because no money-moving route requires auth, IdempotencyInterceptor buckets every caller under a shared 'anonymous' identity per scope, letting unrelated callers collide on each other's cached responses
MergeFi/backend#55 · opened on Aug 16, 2026
2
release() and splitRelease() never check for pre-existing Payment rows, so calling them after releasePartial causes a double payout of the full escrow amount
MergeFi/backend#44 · opened on Aug 16, 2026
3
Money-moving DTOs trust client-supplied contributorId/recipientId/funderAddress instead of binding to the authenticated caller
MergeFi/backend#40 · opened on Aug 16, 2026
2
UsersController.setStellarAddress is authenticated but not authorized: any logged-in user can overwrite another user's payout address
MergeFi/backend#39 · opened on Aug 16, 2026
2
Docker/deployment tooling is entirely absent: no Dockerfile, no docker-compose for local Postgres, no CI pipeline definition
MergeFi/backend#30 · opened on Jul 15, 2026
3